LEARN / ORGS, SUPPORT, ENTERPRISE

Teams, Support and Enterprise

A Fly.io organization has two roles (Member and Admin), optional Google or GitHub SSO, and one monthly bill. Support is sold in three paid tiers (Standard $29, Premium $199, Enterprise from $2,500 a month), and only Enterprise lists a 99.9% uptime SLA. Compliance paperwork (SOC 2 Type 2 report, BAA, DPA) is self-serve or by request (https://fly.io/support, https://fly.io/compliance).

This page is drawn from https://fly.io/docs/security/org-roles-permissions/, https://fly.io/docs/security/sso/, https://fly.io/docs/about/support/, https://fly.io/support/, https://fly.io/docs/about/billing/, https://fly.io/docs/about/pricing/, https://fly.io/docs/security/security-at-fly-io/, https://fly.io/docs/security/shared-responsibility/, https://fly.io/docs/about/healthcare/ and https://fly.io/compliance (fetched 2026-11-04).

Organizations and roles

Role	Can do
Member	Create and destroy apps, deploy, manage secrets, volumes and Machines, view logs and metrics, reach the org’s private network (https://fly.io/docs/security/org-roles-permissions/)
Admin	Everything a Member can, plus invite and remove users, view and update billing, and permanently delete the organization (https://fly.io/docs/security/org-roles-permissions/)

Only two roles. The docs say Fly.io “keeps roles simple on purpose: you get Admins and Members” (https://fly.io/docs/security/org-roles-permissions/). There is no documented billing-only or read-only role [verify: check the dashboard for newer roles].
Split environments into orgs. Organizations are free to create with no technical limit on how many, but each needs a payment method or a linked billing organization (https://fly.io/docs/security/org-roles-permissions/). Each organization has its own private network, so orgs are isolated from each other (https://fly.io/docs/about/billing/).
Read-only access. flyctl tokens create readonly makes a token that cannot change anything. The doc advises not making observers Members at all, because a Member can run fly auth login and get full access (https://fly.io/docs/security/org-roles-permissions/).
Scoped tokens. App-scoped “deploy tokens” and org-scoped tokens exist, and the docs say the personal auth token is no longer the recommended CI credential (https://fly.io/docs/security/tokens/).
Offboarding. Removing a user deletes their automatically generated WireGuard peers, but you must still revoke their tokens, unset secrets they set, and delete manual peers (https://fly.io/docs/security/remove-org-member/).

SSO

Providers. “Fly.io supports Google and GitHub as Identity Providers, and you can use one or both” (https://fly.io/docs/security/sso/).
Setup. In the dashboard, Settings > Single Sign On, then Google SSO Requirement (enter the Google Hosted Domain) or GitHub SSO Requirement (install the Fly.io GitHub app first and enter the GitHub organization ID) (https://fly.io/docs/security/sso/).
Effect. Users re-authenticate to reach org resources once SSO is required (https://fly.io/docs/security/sso/).
Gap to say out loud. The docs list no SAML or generic OIDC login for the dashboard [verify: ask Fly.io before promising Okta or Entra]. Say: “Google Workspace or GitHub org sign-in is documented; anything else, I will confirm.”

Support plans

Plan	Price	What the support page lists
Community	Free	Forum at community.fly.io for everyone (https://fly.io/docs/about/support/)
Standard	$29/mo	36-hour first response, technical architecture support (https://fly.io/support/)
Premium	$199/mo	24-hour first response, 1-hour for urgent issues, dedicated Slack channel, quarterly Solutions Architecture sessions (https://fly.io/support/)
Enterprise	$2,500+/mo	4-hour first response 24x7, 15-minute emergency response 24x7, dedicated Slack channel, quarterly sessions, 99.9% uptime SLA (https://fly.io/support/)

The same prices appear in the pricing docs: Standard at $29/month, Premium at $199/month and Enterprise starting at $2,500/month (https://fly.io/docs/about/pricing/).
Paid plans get an org-specific email address and the Support Portal; billing questions go to billing@fly.io for everyone (https://fly.io/docs/about/support/).
Scope. Supported products include Machines, Volumes, Networking, Managed Postgres and Security. LiteFS and Unmanaged Postgres are listed as not supported (https://fly.io/docs/about/support/).
Published metrics. On 2026-11-04 the support page showed a 30-day record of “100%” of response-time promises kept and a median ticket answer of “1h 12m” (https://fly.io/support/). These numbers move, so re-read before quoting.

Compliance

Topic	What the sources say
SOC 2	“We’re SOC2 (Type 2) audited” (https://fly.io/docs/about/healthcare/). The report is offered on the compliance page (https://fly.io/compliance)
Datacenters	“our hardware runs in ISO 27001 datacenters” (https://fly.io/security/)
HIPAA	Fly.io will sign BAAs (https://fly.io/docs/about/healthcare/). Request one from the dashboard compliance page or email sales@fly.io (https://fly.io/docs/blueprints/going-to-production-with-healthcare-apps/)
GDPR	The compliance page says GDPR users “will need a Data Processing Agreement”, and that Fly.io’s is pre-signed and active once you sign (https://fly.io/compliance). Sub-processors are listed at https://fly.io/legal/sub-processors
Questionnaires	A pre-filled security questionnaire sits in the Trust Center (https://fly.io/compliance)

Price of the compliance package. The healthcare blueprint tells you to choose the Compliance Package (https://fly.io/docs/blueprints/going-to-production-with-healthcare-apps/), but no price appears in the sources I could read [verify with sales].
Shared responsibility. Fly.io owns workers, edges, gateways and the Fly Proxy; the customer owns everything inside the image and Machine, plus org membership and tokens (https://fly.io/docs/security/shared-responsibility/).
Remediation targets. Critical 24 hours, High 1 week, Medium 1 month, Low 3 months (https://fly.io/docs/security/security-at-fly-io/). Vulnerabilities go to security@fly.io (https://fly.io/docs/security/security-at-fly-io/).

SLA and dedicated options

SLA. Only the Enterprise support plan lists a “99.9% uptime SLA” (https://fly.io/support/). I found no public page with credit tiers, measurement rules or exclusions [verify: get the contract text]. The uptime page for live health is https://status.flyio.net/ (https://fly.io/docs/about/support/).
Host-level notices. Host problems show in the dashboard, not on the main status page (https://fly.io/docs/apps/trouble-host-unavailable/).
Dedicated hosts. The Machines API and fly.toml reference carry a host_dedication_id field, described as the ID of a “group of dedicated hosts”, marked beta (https://fly.io/docs/machines/api/machines-resource/, https://fly.io/docs/reference/configuration/). No public pricing or ordering page [verify with sales].
Reservations. Annual prepaid compute credits, for example $3,600/year for $500/month of shared usage, applied in a region across all apps in the org (https://fly.io/docs/about/pricing/).

Billing and invoicing

Cycle. Billing is monthly per organization, invoices download from the dashboard via Stripe (https://fly.io/docs/about/billing/).
Unified billing. A Billing Organization can be billed for up to 100 Linked Organizations on a single invoice. Only admins can link, and a link cannot be undone (https://fly.io/docs/about/billing/).
Payment. Credit card is preferred. Without one, buy credits (minimum $25). Prepaid cards cannot be a saved method but can buy credits (https://fly.io/docs/about/billing/).
No free tier. New accounts get a $1 trial for 7 days or until used (https://fly.io/docs/about/pricing/). Free allowances do not cap the bill and there are no billing alerts (https://fly.io/docs/about/cost-management/).
Surprise bills. Fly.io will “discuss a refund” for mistaken resources or attack traffic if you email billing@fly.io (https://fly.io/docs/about/billing/).

← Sprites and agents · Whiteboard fieldcraft →